54fcfce0fd309d9ea98918264dc2d4602844d0597a2b4e473080cc04dc5dff07

Analysis

max time kernel
150s
max time network
155s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
24-08-2024 06:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

be129abdba1e2c30446614ca4b624fa8_JaffaCakes118.html
Size

103KB
MD5

be129abdba1e2c30446614ca4b624fa8
SHA1

0d431d5e388be28c840cc73e4bf10ae41bd7af08
SHA256

54fcfce0fd309d9ea98918264dc2d4602844d0597a2b4e473080cc04dc5dff07
SHA512

ba1cdf17d616e47320abd28b7aa1039cff1dadb754661e3703f0e5cb9ce87f1e72be7dff08abed9d111be029529348a19b4e9660f4e5fd47e8fb4cc23f9a5b24
SSDEEP

1536:dNtEXPMc0UEmyNtpI1jKbR7Tfv1kq7A48UKrOQGk6nelPtKlneyo+KgQyaHiPsL8:CoCQeyx5tdkjKtnWM

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430643482"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B7F4F041-61E3-11EF-A17A-428A07572FD0} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2916	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2916	iexplore.exe
2916	iexplore.exe
2732	IEXPLORE.EXE
2732	IEXPLORE.EXE
2732	IEXPLORE.EXE
2732	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2916 wrote to memory of 2732	2916	iexplore.exe	30
PID 2916 wrote to memory of 2732	2916	iexplore.exe	30
PID 2916 wrote to memory of 2732	2916	iexplore.exe	30
PID 2916 wrote to memory of 2732	2916	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\be129abdba1e2c30446614ca4b624fa8_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2916
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2916 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\05DDC6AA91765AACACDB0A5F96DF8199

Filesize
854B

MD5
e935bc5762068caf3e24a2683b1b8a88

SHA1
82b70eb774c0756837fe8d7acbfeec05ecbf5463

SHA256
a8accfcfeb51bd73df23b91f4d89ff1a9eb7438ef5b12e8afda1a6ff1769e89d

SHA512
bed4f6f5357b37662623f1f8afed1a3ebf3810630b2206a0292052a2e754af9dcfe34ee15c289e3d797a8f33330e47c14cbefbc702f74028557ace29bf855f9e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
779886cf6427c9123994a8cdb73e181b

SHA1
eb05d5998b8ea7d41293efcb9398d8d402033267

SHA256
d6cab2e034bd783b33c04e43e9d64119e7ea51eef321c235da0b62c7269fa47c

SHA512
aea5ba09fe0956d8976b2e8743ef8422c4c3cb04e4530c7108bec46ff607eac67f946b1b16d67cc81082166ba7e5537915221c0fba9ff8e620770e1340ff6841

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\05DDC6AA91765AACACDB0A5F96DF8199

Filesize
170B

MD5
379ef2bfb8624774323a6ba0294a9193

SHA1
9183649322c2549781cbf35b8de960cf4ac3dd22

SHA256
8b5cb6cdebdb3d50c6e654e33ca7657a1e7b026ddb7d7bb422fd86673034fc76

SHA512
ea3790a34ae369c324052060a1de7ad66f0d1348f28a54ecd197d4baacd1261ba16513942c50b242ac321af1af872b3b0dbae7fba27c30c1bd3b5f94d085354d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
410B

MD5
808895250c5c321499ad9137f5733e4f

SHA1
fe18870c492e8266fe78db15fd446026e40835db

SHA256
50c64e48dadf1003882d11ae7b3db26a0b2756cf10884ae1892487bf8d54634f

SHA512
0a177a47685cb7cd2eef464a117201da950fcc659542472cde15287a78788bb593aa8f9447bf06a72b10ee605f7c6574779fc6541f7776d5c5bd1b62dda969bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
50ae13c120d1ce560bf1ebdb876b2621

SHA1
3b4f5011ef5680de5a7927f72e617345ce3eb145

SHA256
7177a9910230d90390fbca901d326acfb374fe395a3a17697ff3462579e3e5b7

SHA512
3a1c34a9999203db6ec916d680657d958d42da1608d5c63961297225f22c4a884c517235bee7ec74439ce5f6a2116c199dce2de572f3bc95a2cc086f26295709

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dbee285396c7740b6cd0d5e4ba3b5608

SHA1
0c2b863439a635477a480749705d7f45c9310981

SHA256
960e3b7df793eebc3360e869537f5a70e985a8fb31395f92ff767e6434d8e7b5

SHA512
c41360440c9f98e2d086720de5e1aa709747abf5f3a17c0d51f1b0d351c24e4718878392a229525e8fa7fe866a2255ce3a29b70d2219a3113efd09acd52d7f36

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
265518eb9ef2a80320ec0cf9012a0fd1

SHA1
4cee650e3a24b59cd1853894f00dfb0e24dd4f8d

SHA256
8c6fe270ad4ad4c521ac455415afc4076a7c895119ea209e23a52e2cfc2f116d

SHA512
7cb6c7107cc18337e25e8aa889ffc04ea902d7a03fe93bcfc99a9ef2486cbbdc33b1085c2ef870fea18a94cec838a64c359ecc1788755ef58a505552d8965136

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cf461600b3e5414ff71bc61c0a94e07f

SHA1
37564b061828f2ef9e6c62caf04ce75c613564fd

SHA256
da4b330f9f258683d13c5273ca32a84ef07677951d5bc2734d035ddb5df959a5

SHA512
0acef37b79ba2f8ba2e621f678b3da36effb55c8831ae658dc3db60b5c6c5ad30be6dd7cb6c6a16d7bebc2bcd78d140e15ff0884c8a8243db61f78eb7066eb97

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ccf8d3349a89b7005f54a87d1885545e

SHA1
51a1eaeb6d8889366340e0a3b2a6b4a25cd87a86

SHA256
62fa8f44cf09fdbc65afd12ab43083cc432fc797b0027277ff527407b32d3a36

SHA512
7569d45d1258a9a96d4c3b9538a015f049b4e3630bb64e88ec1544e261ea08c69a2ac5744237b7b4b8531600cd5f4e470d6d3bfa28049cc11b70023dda6e71d0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fcd17d8ca95127f842f702fb5d811e53

SHA1
0d3f401d4346932215ac6dbd8caa98397cb02f28

SHA256
c05a83a031b5164fb742f8d650a19f17bbb5c0df8e443c0e23e54fc11a870e56

SHA512
36a25d0d1b938e6d0fec2d572c137ee84d5fda5695a8a6248b2edbeb2bd32613be5edff5e498672339b080e1429eeb2a24a5083f0c970b390c21cb56fbcde1fc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
44746a74cc22cf32a6edc3f6abae6d51

SHA1
2332a14d90be0a328cc6b525cd1c5dfe7f424e3f

SHA256
9706ade8582421a5d2028ebbd4c82ec99e0df4251ea66acbc44f1156ddc6f432

SHA512
1dfac11e0db6f071a21b4ba2a068765307d9c3873a067d24faa4d8b78a3889a752fca53552f4b1bfb9efcde2c5a0460f4ca02b592d76b12a93246d62635f9917

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0d465069c7c2f4bdae6f470aa83bd320

SHA1
988a444520f74cae09f9eb10ae8103a305157d3c

SHA256
10e0b3da549e868d1e953e6b7e27310b038255967a9892fd7290a1ede09c5630

SHA512
e2c3f1797dba72ce112d7e3e81614638575363377f8f9a984a1d12e97b2e35f9069883d3c833e5e2f392900358111386f8763c9066ed715a8ec439a8f436f9ba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a490de9481b76de7a752a7b1263d86cf

SHA1
03318e12de691ff7f324e8643dfc0bea5e1d7df2

SHA256
030582a58c536365b50177e227441a1d0a3c709d822ed25ac10bd1c0a217b6c4

SHA512
45f13af43bcf7cbb57230ecc00718dd183e593823b321d597e369ebe89f1b20abf872350e58c6b29ebdc4f8fc31a5d1560cbc17471bac4ff29e77d4d72dd0929

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
37fdeae10fda4db03654cd0c21cdc6bf

SHA1
d4f4f3dab58b24136399376e1568b4625b535408

SHA256
80fb64707aa98de60314af934b249bd2bba7d2c15c81251307ae3a04eaf06e3c

SHA512
3bd0dc1272130c79979b1530596459c8df1f709dae022156ea6fdf8167069444e99cff7848dfa06de11cd7a8897786c1d5446973918cf583a755c8eddf242c6a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6GL24G53\2[1].htm

Filesize
346B

MD5
51cd23cdc4fc2176f6efb2aeb32eda21

SHA1
cbd43337a0356bb5b460d340dbc8bb676182dd8a

SHA256
3e85af378aa42eb5e2e39fd81b6c372cbf62713ac5a0cba29834796fd499aed8

SHA512
6807dce89ec14d80371b62493f727aa76d9111d59f9af0ac26a37a20f0db73f89732c0b2eccdc50bc0aa30ef45bd3f3bd4d9bb5c555f657e4e16310cece606f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6GL24G53\css[1].css

Filesize
1KB

MD5
056856fd38b7b5bf6fc2b45c548d601b

SHA1
3fab3a1ea36f1bf59972d8609d4ede2493e56290

SHA256
93dfe80c91e20cbcd508ef5c9ce5954350862e2225bff05e7a9e3ba002c908a0

SHA512
774f1d064942669e50cf371937e8eeca85ea7ec873d82dfdde1052156099b811961841d404daf2616e7595b445f4049ec0676201cc882cc42b3221a54977cc7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\K3JH4PQP\3[1].htm

Filesize
346B

MD5
f2fd2bed2cce088840b0cdaf5b8246b4

SHA1
a9f6b9fe4d2e1308daad78e9810ac37b435a64c2

SHA256
cb0a0feac4bde067c09866645a17a27a3890bde7e11ae42c7a86838116bd34bb

SHA512
8da0f86a3c4cbf9c366d557b962515291881ab8e38ee5f96e4f69e9e4eadd9440f404c0dba558b7194b459bb41ed88421e9515f37c04ce997be79605ecbd8d04

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Q98GZSGI\css[1].css

Filesize
386B

MD5
520bbb454ebb45668303365a60aa5b50

SHA1
fe257d0fe3909e2a822bd13bb888a37eaa03788b

SHA256
949f21981a56ad00aae3edce7976272a384674070363dbd507b8b53f5ae0aa23

SHA512
791a28dc912a6d5b30ab08c90d2832ec451a75a25ea200e386ee8b87d4f6ce20f2253476d6f643fcb9540e58a24472aec7fd08a1d7432d8b5fec8af9b1ae90ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Q98GZSGI\js[1].js

Filesize
199KB

MD5
f38dde50ef445947cadc0e88269141c2

SHA1
b3047e7ff524372d199ec998d6b449e23722682a

SHA256
d7ef0f8183f424d3eeefea2214857922d792af3ea107a518da0ca4dbe1b1b9cb

SHA512
dc8587f516eec593a35277cd400fbf63abca92c1bb9c95543911149fdfdcead75dd35d7182bc7c916e1a087b73039ebbd99da402f21e9a7a9dfcc8f606a5011d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R4VBOHSO\4[1].htm

Filesize
346B

MD5
b77c0f478d7d61726835937bbb5cdddd

SHA1
2ded899bd04de9931808d3431eac6bc5aa452e51

SHA256
8b8aec69d8dc5e427570d8bb9f913d3d09b20ef217491b0eca471adb8bf9e4f5

SHA512
0cdbdd620125e6d2783de617d7e3c032cefc2d06b8ef252abe870197762d0a32f3ea762669e853e28bebe2898945954d1e89eb59806a26cf69c68f38c575c599

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R4VBOHSO\css[1].css

Filesize
1KB

MD5
580d9d793944d1d9f1a0475ff1e5dac7

SHA1
a71b5a85af6bc6d67e257a408c4d1a696dce5e6f

SHA256
17769ac78b9d6fab1dabadd8a96927d07c68d8aa3feb39cc61871a2a87674181

SHA512
9f3585b92efd1e5eab049734f658df6dbb9e4114af9d837e6b9caa991c324a31f339e95520121ca892cc98ffe9851340f45cbc44eb3844196a9d1880d59fe21e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3C36.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3C38.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit